Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations 53129 

The digital systems architecture for 

the Airbus Model A350–900 airplane is 

composed of several connected 

networks. This network architecture is 

used for a diverse set of functions, 

providing data connectivity between 

systems, including: 

1. Airplane control, communication, 

display, monitoring and navigation 

systems, 

2. Operator business and 

administrative support systems, 

3. Passenger entertainment systems, 

and 

4. Access by systems external to the 

airplane. 

Discussion 

The Airbus Model A350–900 airplane 

network architecture and configuration 

may allow increased connectivity to, 

and access from, external network 

sources, and operator operations and 

maintenance networks to the airplane 

control domain and operatorinformation-services domain. The 

airplane-control domain and operatorinformation-services domain perform 

functions required for the safe operation 

and maintenance of the airplane. 

Previously, these domains had very 

limited connectivity with external 

network sources. The network 

architecture and configuration may 

allow the exploitation of networksecurity vulnerabilities resulting in 

intentional or unintentional destruction, 

disruption, degradation, or exploitation 

of data, systems, and networks critical 

to the safety and maintenance of the 

airplane. 

The existing regulations and guidance 

material did not anticipate these types 

of airplane system architectures. 

Furthermore, 14 CFR regulations and 

current system-safety assessment policy 

and techniques do not address potential 

security vulnerabilities, which could be 

exploited by unauthorized access to 

airplane networks, data buses, and 

servers. Therefore, these special 

conditions are to ensure that 

unauthorized wired or wireless 

electronic connections do not 

compromise the security (i.e., 

confidentiality, integrity, and 

availability) of airplane systems. 

These special conditions contain the 

additional safety standards that the 

Administrator considers necessary to 

establish a level of safety equivalent to 

that established by the existing 

airworthiness standards. 

Discussion of Comments 

Notice of proposed special conditions 

No. 25–13–17–SC for the Airbus Model 

A350–900 airplane was published in the 

Federal Register on December 17, 2013 

(78 FR 76251) 

Comment From Airbus 

Airbus had one comment about the 

following wording of the first paragraph 

of the Proposed Special Conditions: 

The applicant must ensure airplane 

electronic system security protection 

from access to or by unauthorized 

sources external to the airplane, 

including those possibly caused by 

maintenance activity. 

Airbus considers that the wording ‘‘to 

or by’’ is incorrect. The protection must 

prevent access from unauthorized 

sources external to the airplane only. 

The requirement of protection to 

unauthorized sources external to the 

airplane, is not relevant. 

Therefore, Airbus suggests that the 

wording be modified as follows: 

The applicant must ensure airplane 

electronic system security protection 

from access by unauthorized sources 

external to the airplane, including those 

possibly caused by maintenance 

activity. 

FAA Response 

The FAA agrees with Airbus and has 

changed the special conditions 

accordingly. 

Applicability 

As discussed above, these special 

conditions apply to Airbus Model 

A350–900 series airplanes. Should 

Airbus apply later for a change to the 

type certificate to include another 

model incorporating the same novel or 

unusual design feature, the special 

conditions would apply to that model as 

well. 

Conclusion 

This action affects only certain novel 

or unusual design features on the Airbus 

Model A350–900 series airplanes. It is 

not a rule of general applicability. 

List of Subjects in 14 CFR Part 25 

Aircraft, Aviation safety, Reporting 

and recordkeeping requirements. 

The authority citation for these 

special conditions is as follows: 

Authority: 49 U.S.C. 106(g), 40113, 44701, 

44702, 44704. 

The Special Conditions 

■ Accordingly, pursuant to the authority 

delegated to me by the Administrator, 

the following special conditions are 

issued as part of the type-certification 

basis for Airbus Model A350–900 series 

airplanes. 

1. The applicant must ensure airplane 

electronic system-security protection 

from access by unauthorized sources 

external to the airplane, including those 

possibly caused by maintenance 

activity. 

2. The applicant must ensure that 

electronic system-security threats are 

identified and assessed, and that 

effective electronic system-security 

protection strategies are implemented to 

protect the airplane from all adverse 

impacts on safety, functionality, and 

continued airworthiness. 

3. The applicant must establish 

appropriate procedures to allow the 

operator to ensure that continued 

airworthiness of the airplane is 

maintained, including all post-typecertification modifications that may 

have an impact on the approved 

electronic system-security safeguards. 

Issued in Renton, Washington, on August 

15, 2014. 

Jeffrey E. Duven, 

Manager, Transport Airplane Directorate, 

Aircraft Certification Service. 

[FR Doc. 2014–21243 Filed 9–5–14; 8:45 am] 

BILLING CODE 4910–13–P 

DEPARTMENT OF TRANSPORTATION 

Federal Aviation Administration 

14 CFR Part 25 

[Docket No. FAA–2013–1002; Special 

Conditions No. 25–530–SC] 

Special Conditions: Airbus Model 

A350–900 Airplane; Lightning 

Protection of Fuel-Tank Structure To 

Prevent Fuel-Tank Vapor Ignition 

AGENCY: Federal Aviation 

Administration (FAA), DOT. 

ACTION: Final special conditions. 

SUMMARY: These special conditions are 

issued for Airbus Model A350–900 

airplanes. 

These airplanes will have a novel or 

unusual design feature that will 

incorporate a nitrogen generation 

system (NGS) for all fuel tanks, to 

actively reduce flammability exposure 

within the fuel tanks significantly below 

that required by the fuel-tank 

flammability regulations. Among other 

benefits, the NGS significantly reduces 

the potential for fuel-vapor ignition 

caused by lightning strikes. The 

applicable airworthiness regulations do 

not contain adequate or appropriate 

safety standards for this design feature. 

These special conditions contain the 

additional safety standards that the 

Administrator considers necessary to 

establish a level of safety equivalent to 

that established by the existing 

airworthiness standards. 

DATES: Effective Date: October 8, 2014. 


rmajette on DSK2TPTVN1PROD with RULES
53130 Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations 

FOR FURTHER INFORMATION CONTACT: 

Doug Bryant, Propulsion/Mechanical 

Systems, ANM–112, Transport Airplane 

Directorate, Aircraft Certification 

Service, 1601 Lind Avenue SW., 

Renton, Washington 98057–3356; 

telephone (425) 227–2384; facsimile 

(425) 227–1320. 

SUPPLEMENTARY INFORMATION: 

Background 

On August 25, 2008, Airbus applied 

for a type certificate for their new Model 

A350–900 airplane. Later, Airbus 

requested, and the FAA approved, an 

extension to the application for FAA 

type certification to November 15, 2009. 

The Model A350–900 airplane has a 

conventional layout with twin wingmounted Rolls-Royce Trent XWB 

engines. It features a twin-aisle, 9- 

abreast, economy-class layout, and 

accommodates side-by-side placement 

of LD–3 containers in the cargo 

compartment. The basic Model A350– 

900 airplane configuration 

accommodates 315 passengers in a 

standard two-class arrangement. The 

design cruise speed is Mach 0.85 with 

a maximum take-off weight of 602,000 

lbs. The Model A350–900 series 

airplane has a composite wing and fueltank structure constructed of carbonfiber-reinforced plastic materials. 

Type Certification Basis 

Under Title 14, Code of Federal 

Regulations (14 CFR) 21.17, Airbus must 

show that the Model A350–900 airplane 

meets the applicable provisions of 14 

CFR part 25, as amended by 

Amendments 25–1 through 25–129. 

If the Administrator finds that the 

applicable airworthiness regulations 

(i.e., 14 CFR part 25) do not contain 

adequate or appropriate safety standards 

for the Model A350–900 airplane 

because of a novel or unusual design 

feature, special conditions are 

prescribed under § 21.16. 

Special conditions are initially 

applicable to the model for which they 

are issued. Should the type certificate 

for that model be amended later to 

include any other model that 

incorporates the same novel or unusual 

design feature, the special conditions 

would also apply to the other model 

under § 21.101. 

In addition to the applicable 

airworthiness regulations and special 

conditions, the Model A350–900 

airplane must comply with the fuel-vent 

and exhaust-emission requirements of 

14 CFR part 34, and the noisecertification requirements of 14 CFR 

part 36. The FAA must issue a finding 

of regulatory adequacy under § 611 of 

Public Law 92–574, the ‘‘Noise Control 

Act of 1972.’’ 

The FAA issues special conditions, as 

defined in 14 CFR 11.19, under § 11.38, 

and they become part of the typecertification basis under § 21.17(a)(2). 

Novel or Unusual Design Features 

The Airbus Model A350–900 airplane 

will incorporate the following novel or 

unusual design features: Fuel-tank NGS 

that is intended to control fuel-tank 

flammability for all fuel tanks. This NGS 

is designed to provide a level of 

performance that applies the more 

stringent standard for warm-day 

flammability performance applicable to 

normally emptied tanks within the 

fuselage contour from § 25.981(b), and 

14 CFR part 25 appendix M, to all fuel 

tanks of the Model A350–900 airplane. 

This high level of NGS performance for 

all fuel tanks is a novel or unusual 

design feature not envisioned at the 

time the regulations applying to the 

Model A350–900 airplane certification 

basis were issued. 

Discussion 

The certification basis of the Airbus 

Model A350–900 airplane includes 

§ 25.981, as amended by Amendment 

25–125, as required by 14 CFR 26.37. 

This amendment includes the ignitionprevention requirements in § 25.981(a), 

as amended by Amendment 25–102. It 

includes revised flammability limits for 

all fuel tanks, and new specific 

limitations on flammability for all fuel 

tanks as defined in § 25.981(b), as 

amended by Amendment 25–125. 

Ignition Source Prevention 

Section 25.981(a)(3) requires 

applicants to show that an ignition 

source in the fuel-tank system could not 

result from any single failure, from any 

single failure in combination with any 

latent failure condition not shown to be 

extremely remote, or from any 

combination of failures not shown to be 

extremely improbable. This requirement 

was originally adopted in Amendment 

25–102, and it requires the assumption 

that the fuel tanks are always flammable 

when showing that the probability of an 

ignition source being present is 

extremely remote. (Amendment 25–102 

included § 25.981(c), which required 

minimizing fuel-tank flammability, and 

this was defined in the preamble as 

being equivalent to unheated aluminum 

fuel tanks located in the wing.) This 

requirement defines three types of 

scenarios that must be addressed to 

show compliance with § 25.981(a)(3). 

The first scenario is that any single 

failure, regardless of the probability of 

occurrence of the failure, must not cause 

an ignition source. The second scenario 

is that any single failure, regardless of 

the probability of occurrence, in 

combination with any latent failure 

condition not shown to be at least 

extremely remote, must not cause an 

ignition source. The third scenario is 

that any combination of failures not 

shown to be extremely improbable must 

not cause an ignition source. 

Demonstration of compliance with this 

requirement would typically require a 

structured, quantitative safety analysis. 

Design areas that have latent failure 

conditions typically would be driven by 

these requirements to have multiple 

fault tolerance, or ‘‘triple redundancy.’’ 

This means that ignition sources are still 

prevented even after two independent 

failures. 

Flammability Limits 

Section 25.981(b) states that no fueltank fleet-average flammability exposure 

may exceed 3 percent of the 

flammability-exposure evaluation time 

calculated using the method in part 25, 

Appendix N, or the fleet-average 

flammability of a fuel tank within the 

wing of the airplane being evaluated, 

whichever is greater. If the wing is not 

a conventional, unheated aluminum 

wing, the analysis must be based on an 

assumed equivalent, conventional 

construction, unheated, aluminum 

wing. In addition, for fuel tanks that are 

normally emptied during operation and 

that have any part of the tank located 

within the fuselage contour, the fleetaverage flammability for warm days 

(above 80 °F) must be limited to 3 

percent, as calculated using the method 

in part 25, Appendix M. 

Application of Existing Regulations 

Inappropriate Due to Impracticality 

Since the issuance of § 25.981(a)(3), as 

amended by Amendment 25–102, the 

FAA has conducted certification 

projects in which applicants found it 

impractical to meet the requirements of 

that regulation for some areas of 

lightning protection for fuel tank 

structure. Partial exemptions were 

issued for these projects. These same 

difficulties exist for the Airbus Model 

A350–900 airplane project. 

The difficulty of designing multiplefault-tolerant structure, and the 

difficulty of detecting failures of hidden 

structural-design features in general, 

makes compliance with § 25.981(a)(3) 

uniquely challenging and impractical 

for certain aspects of the electrical 

bonding of structural elements. Such 

bonding is needed to prevent 

occurrence of fuel-tank ignition sources 

from lightning strikes. The effectiveness 

and fault tolerance of electrical-bonding 


rmajette on DSK2TPTVN1PROD with RULES
Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations 53131 

1The memorandum may be viewed at: http:// 

www.airweb.faa.gov/Regulatory_and_Guidance_

Library/rgPolicy.nsf/0/12350AE62D

393B7A862575C300709CA3?OpenDocument

&Highlight=anm-112-08-002 

features for structural joints and 

fasteners is partially dependent on 

design features that cannot be 

effectively inspected or tested after 

assembly without damaging the 

structure, joint, or fastener. Examples of 

such features include a required 

interference fit between the shank of a 

fastener and the hole in which the 

fastener is installed; metal foil or mesh 

imbedded in composite material; a 

required clamping force provided by a 

fastener to pull two structural parts 

together; and a required faying surface 

bond between the flush surfaces of 

adjacent pieces of structural material, 

such as in a wing-skin joint, or a 

mounting-bracket installation. In 

addition, other features that physically 

can be inspected or tested may be 

located within the fuel tanks. Therefore, 

it is not practical to inspect for failures 

of those features at short intervals. 

Examples of such failures include 

separation or loosening of cap seals over 

fastener ends, and actual structural 

failures of internal fasteners. This 

inability to practically detect 

manufacturing errors and failures of 

structural-design features critical to 

lightning protection results in degraded 

conditions that occur and remain in 

place for a very long time, possibly for 

the remaining life of the airplane. The 

complex construction techniques 

associated with composite structure can 

make these aspects particularly 

challenging. 

Accounting for such long failurelatency periods in the system safety 

analysis, required by § 25.981(a)(3), 

would require multiple fault tolerance 

in the structural lightning-protection 

design. As part of the designdevelopment activity for the Model 

A350–900 airplane, Airbus has 

examined possible design provisions to 

provide multiple fault tolerance in the 

structural design to prevent ignition 

sources from occurring in the event of 

lightning attachment to the airplane in 

critical locations. Airbus has concluded 

from this examination that providing 

multiple fault tolerance for some 

structural elements is not practical. 

Airbus has also identified some areas of 

the Model A350–900 airplane design 

where it is impractical to provide even 

single-fault tolerance in the structural 

design to prevent ignition sources from 

occurring in the event of lightning 

attachment after a single failure. The 

FAA has reviewed this examination 

with Airbus in detail and has agreed 

that providing fault tolerance beyond 

that in the Model A350–900 airplane 

design for these areas would be 

impractical. 

As a result of the Airbus Model A350– 

900 airplane and other certification 

projects, the FAA has now determined 

that compliance with § 25.981(a)(3) is 

impractical for some areas of lightning 

protection for fuel-tank structure, and 

that application of § 25.981(a)(3) to 

those design areas is therefore 

inappropriate. The FAA plans further 

rulemaking to revise § 25.981(a)(3). As 

appropriate, the FAA plans to issue 

special conditions or exemptions for 

certification projects progressing before 

the revision is complete. This is 

discussed in FAA Memorandum ANM– 

112–08–002, Policy on Issuance of 

Special Conditions and Exemptions 

Related to Lightning Protection of Fuel 

Tank Structure, dated May 26, 2009.1

Application of Existing Regulations 

Inappropriate Due to Compensating 

Feature That Provides Equivalent Level 

of Safety 

Section 25.981(b) sets specific 

standards for fuel-tank flammability as 

discussed above under ‘‘Flammability 

Limits.’’ Under that regulation, the fleetaverage flammability exposure of all 

fuel tanks on the Model A350–900 

airplane may not exceed 3 percent of the 

flammability-exposure evaluation time 

calculated using the method in part 25, 

Appendix N, or the fleet-average 

flammability of a wing main tank within 

an equivalent construction, 

conventional, unheated, aluminum 

wing fuel tank, whichever is greater. 

The typical fleet-average fuel-tank 

flammability of fuel tanks located in the 

wing ranges between 1 and 5 percent. If 

it is assumed that a Model A350–900 

airplane equivalent, conventional, 

unheated, aluminum wing fuel tank 

would not exceed a fleet-average 

flammability time of 3 percent, the 

actual composite Model A350–900 

airplane wing-fuel-tank design would be 

required to comply with the 3 percent 

fleet average flammability standard, and 

therefore a means to reduce the 

flammability to 3 percent would be 

required. However, the Model A350– 

900 airplane design includes NGS for all 

fuel tanks that will also be shown to 

meet the additional, more-stringent 

warm-day average flammability 

standard in part 25, Appendix M, which 

is only required for normally emptied 

fuel tanks with some part of the tank 

within the fuselage contour. Fuel tanks 

that meet this requirement typically 

have average fuel-tank flammability 

levels well below the required 3 

percent. 

Since the NGS for all fuel tanks on the 

Model A350–900 airplane provides 

performance that meets part 25, 

Appendix M, the FAA has determined 

that the risk reduction provided by this 

additional performance will provide 

compensation for some relief from the 

ignition-prevention requirements of 

§ 25.981(a)(3) while still establishing a 

level of safety equivalent to that 

established in the regulations. 

In determining the appropriate 

amount of relief from the ignitionprevention requirements of § 25.981(a), 

the FAA considered the original overall 

intent of Amendment 25–102, which 

was to ensure the prevention of 

catastrophic events due to fuel-tank 

vapor explosion. These special 

conditions are intended to achieve that 

objective through a prescriptive 

requirement that fault tolerance (with 

respect to the creation of an ignition 

source) be provided for all structural 

lightning protection design features 

where providing such fault tolerance is 

practical, and through a performancebased standard for the risk due to any 

single-failure vulnerability that exists in 

the design. In addition, for any 

structural lightning-protection design 

features for which Airbus shows that 

providing fault tolerance is impractical, 

these special conditions require Airbus 

to show that a fuel-tank vapor-ignition 

event, due to the summed risk of all 

non-fault-tolerant design features, is 

extremely improbable. Airbus would be 

required to show that the design meets 

this safety objective using a structured 

system-safety assessment similar to that 

currently used for demonstrating 

compliance with §§ 25.901 and 25.1309. 

Given these novel or unusual design 

features, and the compliance challenges 

noted earlier in this document, the FAA 

has determined that application of 

§ 25.981(a)(3) is inappropriate in that it 

is neither practical nor necessary to 

apply the ignition-source-prevention 

provisions of § 25.981(a)(3) to the 

specific fuel-tank structural lightningprotection features of the Airbus Model 

A350–900 airplane. However, without 

the § 25.981(a)(3) provisions, the 

remaining applicable regulations in the 

Model A350–900 airplane certification 

basis would be inadequate to set an 

appropriate standard for fuel-tank 

ignition prevention. Therefore, in 

accordance with provisions of § 21.16, 

the FAA has determined that, instead of 

§ 25.981(a)(3), alternative fuel-tank 

structural lighting-protection 

requirements be applied to fuel-tank 

lightning-protection features that are 

integral to the airframe structure of the 


rmajette on DSK2TPTVN1PROD with RULES
53132 Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations 

Model A350–900 airplane. These 

alternative requirements are intended to 

provide the level of safety intended by 

§ 25.981(a)(3), based on our recognition, 

as discussed above, that a highly 

effective NGS for the fuel tanks makes 

it unnecessary to assume that the fuel 

tank is always flammable. As discussed 

previously, the assumption that the fuel 

tanks are always flammable was 

required when demonstrating 

compliance to the ignition-prevention 

requirements of § 25.981(a)(3). 

One resulting difference between 

these special conditions and the 

§ 25.981(a)(3) provisions they are meant 

to replace is the outcome being 

prevented—fuel-vapor ignition versus 

an ignition source. These special 

conditions acknowledge that the 

application of fuel-tank-flammability 

performance standards will reduce fueltank flammability to an extent that it is 

appropriate to consider the beneficial 

effects of flammability reduction when 

considering design areas where it is 

impractical to comply with 

§ 25.981(a)(3). 

One of the core requirements of these 

special conditions is a prescriptive 

requirement that structural lightningprotection design features must be fault 

tolerant. (An exception, wherein Airbus 

can show that providing fault tolerance 

is impractical, and associated 

requirements, is discussed below.) The 

other core requirement is that Airbus 

must show that the design, 

manufacturing processes, and 

Airworthiness Limitations section of the 

Instructions for Continued 

Airworthiness include all practical 

measures to prevent, and detect and 

correct, failures of structural-lightning 

protection features due to 

manufacturing variability, aging, wear, 

corrosion, and likely damage. The FAA 

has determined that, if these core 

requirements are met, a fuel-tank vaporignition event, due to lightning, is not 

anticipated to occur in the life of the 

airplane fleet. This conclusion is based 

on the fact that a critical lightning strike 

to any given airplane is itself a remote 

event, and on the fact that fuel tanks 

must be shown to be flammable only for 

a relatively small portion of the fleet 

operational life. 

For any non-fault-tolerant features in 

the design, Airbus must show that 

eliminating these features or making 

them fault tolerant is impractical. The 

requirements and considerations for 

showing it is impractical to provide 

fault tolerance are described in FAA 

Memorandum ANM–112–08–002. This 

requirement is intended to minimize the 

number of non-fault-tolerant features in 

the design. 

For areas of the design where Airbus 

shows that providing fault-tolerant 

structural lighting-protection features is 

impractical, non-fault-tolerant features 

will be allowed, provided Airbus can 

show that a fuel-tank vapor-ignition 

event, due to the non-fault-tolerant 

features, is extremely improbable when 

the sum of probabilities of those events, 

due to all non-fault-tolerant features, is 

considered. Airbus will be required to 

submit a structured, quantitative 

assessment of fleet-average risk for a 

fuel-tank vapor-ignition event due to all 

non-fault-tolerant design features 

included in the design. This will require 

determination of the number of nonfault-tolerant design features, estimates 

of the probability of the failure of each 

non-fault-tolerant design feature, and 

estimates of the exposure time for those 

failures. This analysis must include 

failures due to manufacturing 

variability, aging, wear, corrosion, and 

likely damage. 

It is acceptable to consider the 

probability of fuel-tank flammability, 

the probability of a lightning strike to 

the airplane, the probability of a 

lightning strike to specific zones of the 

airplane (for example, Zone 2 behind 

the nacelle, but not a specific location 

or feature), and a distribution of 

lightning-strike amplitude in performing 

the assessment, provided the associated 

assumptions are acceptable to the FAA. 

The analysis must account for any 

dependencies among these factors, if 

they are used. The assessment must also 

account for operation with inoperative 

features and systems, including any 

proposed or anticipated dispatch relief. 

This risk-assessment requirement is 

intended to ensure that an acceptable 

level of safety is provided given the 

non-fault-tolerant features in the design. 

Part 25, Appendix N, as adopted in 

Amendment 25–125, in conjunction 

with these special conditions, 

constitutes the standard for how to 

determine flammability probability. In 

performing the safety analysis required 

by these special conditions, relevant 

§ 25.981(a)(3) compliance guidance is 

still applicable. Appropriate credit for 

the conditional probability of 

environmental or operational conditions 

occurring is normally limited to those 

provisions involving multiple failures, 

and this type of credit is not normally 

allowed in evaluation of single failures. 

However, these special conditions 

would allow consideration of the 

probability of occurrence of lightning 

attachment and flammable conditions 

when assessing the probability of 

structural failures resulting in a fueltank vapor-ignition event. 

The FAA understands that lightningprotection safety for airplane structure 

is inherently different from lightning 

protection for systems. We intend to 

apply these special conditions only to 

structural lightning-protection features 

of fuel systems. We do not intend to 

apply the alternative standards used 

under these special conditions to other 

areas of the airplane-design evaluation. 

Requirements Provide Equivalent Level 

of Safety 

In recognition of the unusual design 

feature discussed above, and the 

impracticality of requiring multiple 

fault tolerance for lightning protection 

of certain aspects of fuel-tank structure, 

the FAA has determined that a level of 

safety equivalent to direct compliance 

with § 25.981(a)(3) will be achieved for 

the Model A350–900 airplane by 

applying these requirements. The FAA 

considers that, instead of only 

concentrating on fault tolerance for 

ignition-source prevention, significantly 

reducing fuel-tank flammability 

exposure, in addition to preventing 

ignition sources, is a better approach to 

lightning protection for the fuel tanks. 

In addition, the level of average fueltank flammability achieved by 

compliance with these special 

conditions is low enough that it is not 

appropriate or accurate to assume, in a 

safety analysis, that the fuel tanks may 

always be flammable. 

Section 25.981(b), as amended by 

Amendment 25–125, sets limits on the 

allowable fuel-tank flammability for the 

Model A350–900 airplane. Condition 

2(a) of these special conditions applies 

the more-stringent standard, for warmday flammability performance 

applicable to normally emptied tanks 

within the fuselage contour, from 

§ 25.981(b) and part 25, Appendix M, to 

all of the fuel tanks of the Model A350– 

900 airplane. 

Because of the more-stringent fueltank flammability requirements in these 

special conditions, and because the 

flammability state of a fuel tank is 

independent of the various failures of 

structural elements that could lead to an 

ignition source in the event of lightning 

attachment, the FAA has agreed that it 

is appropriate in this case to allow 

treatment of flammability as an 

independent factor in the safety 

analysis. The positive control of 

flammability, and the lower 

flammability that is required by these 

special conditions, exceed the minimum 

requirements of § 25.981(b). This offsets 

a reduction of the stringent standard for 

ignition-source prevention in 

§ 25.981(a)(3), which assumes that the 

fuel tank is flammable at all times. 


rmajette on DSK2TPTVN1PROD with RULES
Federal Register / Vol. 79, No. 173 / Monday, September 8, 2014 / Rules and Regulations 53133 

Given the stringent requirements for 

fuel-tank flammability, the fuel-vapor 

ignition prevention, and the ignitionsource prevention requirements in these 

special conditions will prevent ‘‘. . . 

catastrophic failure . . . due to ignition 

of fuel or vapors,’’ as stated in 

§ 25.981(a). Thus, the overall level of 

safety achieved by these special 

conditions is considered equivalent to 

that which would be required by 

compliance with § 25.981(a)(3) and (b). 

These special conditions contain the 

additional safety standards that the 

Administrator considers necessary to 

establish a level of safety equivalent to 

that established by the existing 

airworthiness standards. 

Discussion of Comments 

Notice of proposed special conditions 

No. 25–13–36–SC for Airbus Model 

A350–900 series airplanes was 

published in the Federal Register on 

December 19, 2013 (78 FR 76775). No 

comments were received, and the 

special conditions are adopted as 

proposed. 

Applicability 

As discussed above, these special 

conditions apply to Airbus Model 

A350–900 series airplanes. Should 

Airbus apply later for a change to the 

type certificate to include another 

model incorporating the same novel or 

unusual design feature, the special 

conditions would apply to that model as 

well. 

Conclusion 

This action affects only certain novel 

or unusual design features on the Airbus 

Model A350–900 series airplanes. It is 

not a rule of general applicability. 

List of Subjects in 14 CFR Part 25 

Aircraft, Aviation safety, Reporting 

and recordkeeping requirements. 

The authority citation for these 

special conditions is as follows: 

Authority: 49 U.S.C. 106(g), 40113, 44701, 

44702, 44704. 

The Special Conditions 

■ Accordingly, pursuant to the authority 

delegated to me by the Administrator, 

the following special conditions are 

issued as part of the type-certification 

basis for Airbus Model A350–900 series 

airplanes. 

1. Definitions 

Most of the terms used in the special 

conditions described in Alternative Fuel 

Tank Structural Lightning Protection 

Requirements either have the common 

dictionary meaning or are defined in 

Advisory Circular 25.1309–1A, System 

Design and Analysis, dated June 21, 

1988. 

The following definitions are the only 

terms intended to have a specialized 

meaning when used in these special 

conditions: 

(a) Basic Airframe Structure. Includes 

design elements such as structural 

members, structural joint features, and 

fastener systems including airplane 

skins, ribs, spars, stringers, etc., and 

associated fasteners, joints, coatings, 

and sealant. Basic airframe structure 

may also include those structural 

elements that are expected to be 

removed for maintenance, such as 

exterior fuel-tank access panels and 

fairing-attachment features, provided 

maintenance errors that could 

compromise associated lightningprotection features would be evident 

upon an exterior, preflight inspection of 

the airplane and would be corrected 

prior to flight. 

(b) Permanent System-Supporting 

Structure. Includes static, permanently 

attached structural parts (such as 

brackets) that are used to support 

system elements. It does not include any 

part intended to be removed, or any 

joint intended to be separated, to 

maintain or replace system elements or 

other parts, unless that part removal or 

joint separation is accepted by the FAA 

as being extremely remote. 

(c) Manufacturing Variability. 

Includes tolerances and variability that 

the design and production 

specifications allow, as well as 

anticipated errors or escapes from the 

manufacturing and inspection 

processes. 

(d) Extremely Remote. Conditions that 

are not anticipated to occur to each 

airplane during its total life, but which 

may occur a few times when 

considering the total operational life of 

all airplanes of one type. Extremely 

remote conditions are those having an 

average probability per flight hour on 

the order of 1 × 10¥7 or less, but greater 

than on the order of 1 × 10¥9. 

(e) Extremely Improbable. Conditions 

that are so unlikely that they are not 

anticipated to occur during the entire 

operational life of all airplanes of one 

type. Extremely improbable conditions 

are those having an average probability 

per flight hour of the order of 1 × 10¥9

or less. 

2. Alternative Fuel-Tank Structural 

Lightning-Protection Requirements 

For lightning-protection features that 

are integral to fuel-tank basic airframe 

structure or permanent systemsupporting structure, as defined in this 

these special conditions Definitions, for 

which Airbus shows and the FAA finds 

compliance with § 25.981(a)(3) to be 

impractical, the following requirements 

may be applied in lieu of the 

requirements of § 25.981(a)(3): 

(a) Airbus must show that the airplane 

design meets the requirements of part 

25, Appendix M, as amended by 

Amendment 25–125, for all fuel tanks 

installed on the airplane. 

(b) Airbus must show that the design 

includes at least two independent, 

effective, and reliable lightningprotection features (or sets of features) 

such that fault tolerance to prevent 

lightning-related ignition sources is 

provided for each area of the structural 

design to be shown compliant with 

these special conditions in lieu of 

compliance with the requirements of 

§ 25.981(a)(3). Fault tolerance is not 

required for any specific design feature 

if: 

(1) For that feature, providing fault 

tolerance is shown to be impractical, 

and 

(2) Fuel-tank vapor ignition due to 

that feature and all other non-faulttolerant features, when their fuel-tank 

vapor-ignition event probabilities are 

summed, is shown to be extremely 

improbable. 

(c) Airbus must perform an analysis to 

show that the design, manufacturing 

processes, and airworthiness limitations 

section of the instructions for continued 

airworthiness include all practical 

measures to prevent, and detect and 

correct, failures of structural lightningprotection features due to 

manufacturing variability, aging, wear, 

corrosion, and likely damage. 

Issued in Renton, Washington, on August 

15, 2014. 

Jeffrey E. Duven, 

Transport Airplane Directorate, Aircraft 

Certification Service. 

[FR Doc. 2014–21245 Filed 9–5–14; 8:45 am] 

BILLING CODE 4910–13–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Food and Drug Administration 

21 CFR Parts 310, 314, 329, and 600 

[Docket No. FDA–2008–N–0334] 

RIN 0910–AF96 

Postmarketing Safety Reports for 

Human Drug and Biological Products; 

Electronic Submission Requirements; 

Correction 

AGENCY: Food and Drug Administration, 

HHS. 

ACTION: Final rule; correction. 


rmajette on DSK2TPTVN1PROD with RULES